Create reusable plans faster with custom templates in Planner
Turn any basic plan in Microsoft Planner into a reusable, shareable template to speed up planning and ensure consistency across plans. Custom templates capture key plan elements such as tasks, goals, buckets, labels, notes, attachments, and checklists to help teams plan faster and stay consistent. To publish a template, create and customize a basic plan to fit your needs. When you're ready, select Share and choose Publish as Template. Enter a template name and description, pick the Microsoft 365 group to share it with, choose which parts of the plan to include, and select Publish. fields selected. Once published, the template can be reused to create new basic plans. To create a plan from a template, click Create a plan, then go to either Shared or Created by me and select a template to use. How teams use custom templates Standardized onboarding processes An HR team onboarding new hires each month can use a custom template to create plans with the right tasks, buckets, and checklists already in place, helping ensure each onboarding follows the same process. Fast project setup with templates A marketing team launches frequent campaigns and uses a custom template to spin up new plans instantly. With pre-filled tasks, attachments, and checklists built in, they save time and stay aligned on key details. Addressing your feedback Tell us what you think about custom templates by selecting the Feedback icon (person with a chat bubble) in the top right corner of the app, then select Feedback from the dropdown menu. We also encourage you to share any feature requests by adding your ideas to the Planner Feedback Portal. Your feedback helps inform our feature updates, and we look forward to hearing from you. Learn more Learn how to use custom templates in Planner. Learn how to export and manage Planner custom template data. Visit planner.cloud.microsoft to access Planner directly from your browser. Sign up to receive future communication about Planner. Check out the Planner adoption page and Planner help & learning page to learn more about Planner. Visit the Microsoft 365 roadmap for feature descriptions and estimated release dates for Planner.Introducing a refreshed design, task chat, and more in Microsoft Planner
We’re excited to announce that a modernized user interface and new features are now rolling out to basic plans in both Planner in Teams and Planner for the web. The updated design offers enhanced navigation, responsive layouts, a new goals view for setting objectives and priorities, and task chat—one of your most requested features—to enable real-time collaboration and @ mentioning team members. This release aims to make planning easier for everyday users while preparing for future AI-powered capabilities. Our goal is to streamline planning by making it more intelligent and connected, so teams can concentrate on achieving results rather than managing tasks. What's new in Planner A refreshed design: With this rollout, users will be able to manage their plans in a cleaner, more modern interface that brings a more consistent planning experience across work. Planner’s new look was designed to feel simpler, allowing users to find what they need. It reduces visual clutter, improves layout and spacing, and creates a more focused workspace. Task chat with @ mentions: A new task chat is coming to basic plans, bringing real-time, threaded conversations directly into tasks, including @ mentions, rich formatting, emojis, and notifications to help keep decisions tied to the specific task at hand. Plan members who are @ mentioned in a task will receive a notification in their Teams Activity feed and via email and can select the notification which takes them directly to the task card for additional context. Note that previously, users received notifications for every task comment, but as a result of customer feedback, we now only send notifications to mentioned users. The ability to @ mention team members directly in a task has been a top request, and we’re excited to roll this out in a familiar, chat-based experience. Please note, premium plans will continue to utilize the existing task conversation experience. This will converge into the new experience at a later point in time. Goals view: Basic plans will now include a dedicated Goals view, allowing teams to set clear, well-defined objectives to help prioritize work. By connecting tasks to shared goals, teams achieve greater alignment, gain clarity on priorities, and track progress and outcomes—driving the plan forward together. Access to Goals view in basic plans requires either a Planner premium license or a Microsoft 365 Copilot license. Notes on availability Please note that not all users will see the new Planner interface at the same time. This refreshed interface, along with Task chat and Goals view, begins rolling out to basic plans today and will continue to roll out over the coming weeks. This is only the beginning This redesign lays the groundwork for many more improvements coming to Planner in the next few weeks and months, including: Project Manager agent in basic plans – to help with task execution and the creation of status reports. Custom templates. Planner in Outlook. Stay tuned for announcements regarding these updates and more aligned to our long-term vision for integrated work management. Feature availability, naming, and timelines are subject to change. Please refer to the Microsoft 365 Roadmap for the latest status. Addressing your feedback We heard your feedback about inconsistencies between basic and premium plans. This refresh starts closing those gaps, so features appear consistently across plans based on your license. For example, users with a Planner premium license will now see Goals in basic plans, and users with a Microsoft 365 Copilot license will soon have access to Project Manager Agent in basic plans as well. Tell us what you think about the new Planner interface, Task chat, and Goals view by selecting More (circled question mark icon) in the top right corner of the app, then selecting Feedback from the dropdown menu. We also encourage you to share any feature requests by adding your ideas to the Planner Feedback Portal. Your feedback helps inform our feature updates, and we look forward to hearing from you. Learn more Visit planner.cloud.microsoft to access Planner directly from your browser. Sign up to receive future communication about Planner. Learn more about Planner in our Frequently asked questions. Check out the Planner adoption page and Planner help & learning page to learn more about Planner. Visit the Microsoft 365 roadmap for feature descriptions and estimated release dates for Planner. Walk through the interactive demos for Project Manager Agent in Planner and Project Manager Agent skills in Teams meetings.ICYMI: Partner Blog | From AI curiosity to Copilot adoption in 30 days
Thirty days. Twenty-five users. One clear path to AI. For small and medium-sized businesses, AI is no longer a someday conversation, it's a right-now decision. SMB customers aren't asking whether AI matters anymore; they're asking how to put it to work in ways that are practical, fast, and secure. The hard part isn't interest. It's the starting line. Customers are looking to identify relevant use cases, experience AI in their everyday work, and evaluate its value before making a broader commitment. This creates a significant opportunity for Cloud Solution Provider (CSP) partners to lead customers from initial interest to sustained adoption. The SMB segment represents a Microsoft-estimated $625 billion* market opportunity in FY27, yet most organizations remain early in their AI transformation journey. Continue reading hereWhat's New in Microsoft Teams | April 2026
Our team just wrapped up the M365 Community Conference in Orlando, FL, and it was an incredible way to close out April! Our teams were energized by connecting with, listening to, and sharing what’s new with many of you: the builders, innovators and icons of intelligent work. Thank you to everyone who attended, and we can’t wait to see even more of you at next year’s conference! As for this month’s Teams updates, we remain focused on bringing you features that can make collaboration more intelligent, secure, and seamless—whether you’re working with AI, managing calls, or enabling hybrid teams at scale. Across meetings, calling, and the workplace, you’ll find improvements designed to remove friction, from smarter call handling with intelligent call delegation, to Interpreter agent enhancements that support proper attribution for sign-language users in meetings, and updated room booking and live transcription in meetings in Teams Rooms. In another new update, Targeted messages for agents now enables your agents and bots to send targeted, private, temporary updates to specific users in chats, channels, and meetings, without interrupting everyone else. We’re also delivering meaningful security and compliance enhancements, including sensitivity label inheritance for meeting recordings and Loop notes, improved admin visibility into external collaboration risks, and new user‑reported security signals in the Teams admin center. These updates help organizations protect information end to end, without slowing down teamwork. Together, these updates reflect our continued focus on helping teams collaborate more effectively, confidently, and securely—every day. Read on for all the latest updates! Feature categories: (All features listed are generally available unless otherwise noted) Chat and Collaboration Meetings Teams Phone Workplace Fundamentals and Security Platform Frontline Workers Certified for Teams Devices Chat and Collaboration Targeted messages for agents on Teams Send private, targeted messages from agents or bots to a specific person in a channel, group chat, or meeting—without distracting everyone else. Agents can share timely prompts, reminders, or next steps only with the people who need them, keeping conversations focused and clutter-free. As situations change, agents can update or remove these messages so guidance stays relevant and accurate. To enable targeted messaging for agents visit this page: Targeted Messages - Teams | Microsoft Learn Simplified Teams app bar The Teams app bar has been simplified to help you focus on what matters. App labels are hidden by default to reduce visual noise, the overflow menu is less cluttered, and you can now choose to show or hide the app bar to create more space for your work. New controls for quick views in the Teams chat list Positioned at the top of the chat and channels list in Teams, quick view controls provide fast access to mentions, followed threads, and more. You can choose when and how quick views are displayed – and can collapse the section at any time. Experts & verified answers in communities Help community members quickly identify trusted responses with Community Experts and verified answers. In the Engage app for Android and the Engage app in Teams for iOS and Android, members can request expert status, which admins can review and assign. Approved experts are highlighted with a special label next to their names and, along with admins, can endorse accurate and credible responses. Once marked, these responses receive a “verified” label, making it easy for viewers to recognize correct answers and rely on trusted expertise across community conversations. Microsoft Viva: Engage community membership management in Teams for iOS & Android Manage your communities on the go. Community admins can now add or remove members directly from the Teams mobile app on iOS and Android. Keep your Viva Engage communities up to date—anytime, anywhere. Meetings Consecutive interpretation in Interpreter agent Consecutive interpretation is a new mode in Microsoft Teams Interpreter that helps participants collaborate more naturally in meetings with two spoken languages. With consecutive interpretation, the translation begins after each speaker finishes speaking. This creates a turn-based flow that more closely reflects how people naturally communicate in multilingual conversations. In addition, consecutive interpretation brings Interpreter onto the meeting stage for everyone to see and hear, making it easier to follow, participate, and stay aligned. With this update, Interpreter now supports two modes: real-time simultaneous interpretation, launched last year, and the new consecutive interpretation mode designed for back-and-forth conversations—now available in public preview. Accurate transcript attribution for meetings with sign language interpreters Transcripts now attribute contributions to the original participant using sign language, not the interpreter. This ensures ideas and decisions are correctly credited to the person who shared them, including in Copilot chat and meeting recap. Spoken language detection is now automatic Spoken language detection is now fully automatic. Teams will automatically detect each speaker’s spoken language and update it in real time as the conversation evolves. Manual spoken language selection will no longer be available. This applies to both live captions and transcripts when Interpreter is enabled or when multilingual speech recognition is turned on in meeting options, helping deliver more accurate language recognition and a more consistent multilingual meeting experience. Teams meeting Notes, powered by Loop Teams meeting Notes, powered by Loop, are now available for instant meetings that started via ‘Meet now’ from the calendar. Notes are Loop components in Teams meetings and chats that allow end users to co-create and collaborate on their meeting agenda, notes, and action items that can be co-authored and edited by everyone. Since Notes are Loop components, they stay in sync across all the places they have been shared. Once added, meeting notes can also be shared and edited in the Loop app in your web browser. Resize the top video gallery in Teams meetings to see more people when content is being shared. Now you can resize the video gallery at the top of your meeting window when content is being shared, making it easy to see more participants alongside the presentation. Simply drag the divider between the shared content and the video gallery to adjust how much space each takes up. Whether you're in a small team sync or a large all-hands meeting, this gives you the flexibility to keep more faces visible while staying focused on what's being presented, helping everyone feel seen and engaged. Available on Windows desktop and Mac. Teams Phone Intelligent call delegation - Frontier Incoming calls don’t wait for a break in your day. Whether you’re leading a meeting or juggling back-to-back commitments, every new call creates the same dilemma: answer and risk losing momentum, or ignore it and risk missing something important. Intelligent call delegation can now help answer your incoming Teams calls and schedule follow-up appointments on your behalf. After turning on the experience in the Teams Calls settings, intelligent call delegation gathers context from callers that it shares with you to help you decide whether to pick up. It can also set up follow-up appointments via Microsoft Bookings so that you remember to meet with the callers that matter most. Learn more about intelligent call delegation and how to access for organizations enrolled in the Frontier program. Teams Phone user multi-line Many organizations need a way for a single person to represent multiple departments or regions in calling without juggling different Teams accounts, devices, or complicated routing workarounds. Teams Phone user multi-line now enables Teams administrators to configure and assign up to 10 phone numbers to an individual user through Teams admin center. Supported across desktop and Teams phone devices, user multi-line is ideal for individuals who handle multiple roles or who call contacts across different geographies. For example, a communications director supporting both press relations and analyst relations can take inbound calls for either function and place outbound calls using the appropriate number, all within a unified Teams experience. Or a customer success manager covering North America and Europe can use dedicated regional numbers so that customers reach the right line and interact with a familiar local caller ID, helping build greater trust. Learn more. Workplace - Rooms Ad-hoc room reservation from Teams Rooms on Android console With Teams Rooms on Android consoles, you can quickly book a meeting room for immediate use, helping to avoid scheduling conflicts and ensure uninterrupted spontaneous meetings. Available in Teams Rooms Pro-licensed rooms. Learn more. Live transcription in Teams Rooms on Android View and control live transcription during a meeting from a Teams Rooms on Android device. The real-time transcript includes speaker names and timestamp. You can adjust settings such as spoken language, translated language, and whether both original and translated transcripts are displayed side by side on the front of room display. This feature is available in Teams Rooms Pro. Learn more. Digital signage in Teams Rooms on Android As with Teams Rooms on Windows, IT Admins can now set up Teams Rooms on Android to show dynamic content on the front-of-room display when not in use. Configuration is available for tenant-wide and room-specific settings via the Teams Rooms Pro Management portal. The feature supports select third-party digital signage partners like Appspace and XOGO, and is included with Teams Rooms Pro. Learn more. Fundamentals and Security Sensitivity label inheritance for meeting recordings and Loop meeting notes Meeting recordings and Loop meeting notes now automatically inherit your meeting’s sensitivity label. When admins enable label inheritance in the sensitivity label policy, any labeled meeting applies the same label to its MP4 recording and meeting notes, ensuring access controls and protections like data handling rules and encryption carry forward consistently. This also ensures that Copilot and agent responses based on transcripts and notes accurately reflect the meeting’s sensitivity, keeping confidential content protected end to end. External Domains Anomalies Report The External Domains Anomalies Report helps admins proactively identify unusual or risky interactions with external organizations in Microsoft Teams. By analyzing communication trends and detecting sudden spikes, new domains, or abnormal engagement patterns, it provides early visibility into potential data-sharing or security risks. As external collaboration continues to grow, this report offers admins actionable insights to protect their tenants while maintaining productive cross-organization collaboration. The report is available in the Teams Admin Center. It’s updated daily, and admins can select a time range to view (for example, the past 24 hours or past 7 days). User reported security signals in Teams admin center This update brings end‑user security reporting into Teams Admin Center. Admins can now view and download signals from messages users report as “a security concern” or “not a security concern” within TAC Protection reports, helping them identify trends and fine‑tune policies and responses. Microsoft Teams VDI Optimization for Omnissa on Windows Microsoft Teams has long supported Omnissa in Virtual Desktop Infrastructure (VDI) environments; this feature advances that support by bringing Omnissa deployments onto Microsoft’s modern Teams VDI optimization architecture. With this update, organizations running Teams on Omnissa can take advantage of the new optimization to deliver improved performance, greater feature parity with the native desktop client, and a more reliable experience for meetings, audio, video, and screen sharing—while continuing to benefit from the centralized management, security, and scalability of VDI. Trigger workflows from messages on Teams mobile (Android and iOS) Users can now trigger Microsoft Teams workflows directly from a message on Teams mobile for Android and iOS, enabling common automation scenarios - such as approvals, notifications, or follow‑up actions - without switching devices or leaving the conversation. This update extends workflow message actions to mobile, improves UI reliability, and helps close parity gaps between desktop and mobile experiences for Teams workflows. Prevent screen capture for iOS Prevent screen capture is now available on the Microsoft Teams iOS app. When enabled, this setting helps protect your meeting by preventing the meeting window from being captured in screenshots. This capability builds on the Prevent screen capture experience already available on Desktop Windows and Android mobile app, helping organizations apply more consistent protections across supported Teams clients when discussing confidential topics. Mac desktop, virtual desktop, and older clients aren't supported. People on these platforms will not be able to turn on their own video, share their screen, or see other's videos or shared screens. Platform Python support in the Microsoft Teams SDK Teams SDK is now available in Python. With the Teams SDK, developers have a production‑ready foundation for building intelligent collaboration‑centric experiences directly within Microsoft Teams. And now, Python developers can take full advantage of that platform, using the same SDK surface that powers modern Teams apps and agents. You can learn more about the Python release of the Teams SDK in the Getting Started | Teams SDK documentation. Frontline workers Pilots Kickstart frontline innovation with the Frontline Hub in Teams admin center. Create pilots in just a few clicks—choose the capabilities you want to test, select workers and managers, and monitor adoption through real-time usage insights. With built-in management controls, you can easily iterate as you learn: adjust features, update participants, and expand channels—all without slowing down your rollout. Deploy at scale Deploying Microsoft Teams to your frontline workforce is now faster and more seamless than ever. A new guided deployment experience in the Teams admin center lets you roll out a standardized Teams setup—whether you’re expanding a pilot or launching organization‑wide—in just a few steps. From one place, you can add frontline workers, organize them into teams, and apply a consistent pinned app configuration that updates automatically as your needs evolve. Once deployed, the Frontline hub gives you centralized control to manage teams, adjust pinned apps across your entire frontline workforce, and monitor adoption with built‑in usage insights. This streamlined approach helps you scale confidently, maintain consistency, and keep every frontline worker connected with the tools they rely on. Certified for Teams Devices Cisco Express Install Solutions for Teams Rooms Cisco Express Install solutions are fully integrated meeting room packages designed for fast, large‑scale deployment of Microsoft Teams Rooms. These Cisco‑certified bundles combine Cisco Room Bar or Room Bar Pro devices with Samsung commercial displays and Ashton Bentley freestanding mounts. Ergonomically designed for optimal camera angles and viewing height, the solutions deliver a consistent, familiar Teams Rooms experience across locations while enabling rapid global rollout with minimal on‑site effort. Two bundles (each available in either First Light or Carbon color) feature the Cisco Room Bar package and are designed for huddle spaces, focus rooms, and small meeting rooms: Cisco Room Bar with 43” display Cisco Room Bar with 55” display Two bundles (each available in either First Light or Carbon color) feature the Cisco Room Bar Pro package and are designed for small and mid-sized meeting rooms: Cisco Room Bar Pro with 75” display Cisco Room Bar Pro with two 55” displays One bundle (available in either First Light or Carbon color) features the Cisco Room Kit EQ package and is designed for midsize, large, and extra-large meeting rooms: Cisco Room Kit EQ with 105” display Neat Express Install: TAA-Compliant Neat Board Pro with Heckler Stand Neat Board Pro with the Heckler Stand is TAA compliant, making it easier for US federal government agencies, higher‑education institutions, and other public‑sector organizations to bring award‑winning video collaboration solutions into their workspaces. Together, they provide cutting‑edge audiovisual and AI‑driven capabilities—supporting high‑performance cameras, far‑field microphones, and immersive 4K touch experiences designed for medium to large spaces. Learn more. Jabra Express Install: PanaCast 40 VBS Bundles (LG displays available in: 43″ / 50″ / 55″ / 65″) The Jabra PanaCast 40 VBS teams up with Salamander Designs Acadia Tabletop Stand and LG 4K UHD displays to transform huddle rooms, focus rooms, and small meeting spaces into smart collaboration zones—fast. With panoramic video, intelligent audio, and clean cable management, this Express Install bundle is designed for sub‑90‑minute installation with no wall drilling or rewiring required. It’s a true plug‑and‑play Teams Rooms solution that’s easy to deploy, simple to manage, and ready for AI‑powered productivity. Learn more. Jabra PanaCast 40 VBS + Control IP PanaCast 40 VBS brings everyone into the picture with its 180° field‑of‑view and 4K precision—capturing every participant clearly, even those close to the screen or seated in the corners. AI‑powered video features track speakers, adjust views, and keep conversations natural for more productive meetings. Setup is quick, so rooms are ready in minutes. Built on the Microsoft Device Ecosystem Platform for robust security, and managed through Jabra+, it enables remote, real‑time device updates to keep collaboration seamless. Learn more. MAXHUB XBoard V7 (Display available in 55″ and 75″) The MAXHUB XBoard for Microsoft Teams Rooms is a Teams‑certified interactive display running Windows 11 IoT that delivers an all‑in‑one solution for meeting rooms and open spaces. Its Trident Lens triple‑camera system ensures clear, dynamic video calls, while Audio Fence technology filters background noise for crisp communication. With a high‑color‑gamut 4K/5K non‑glare display, flexible sizing, optional on‑seat touch console, and remote device management via MAXHUB Pivot, XBoard V7 offers a reliable, scalable collaboration experience with easy plug‑and‑play setup and a three‑year warranty. Learn more. MAXHUB Universal Console TCP33T MAXHUB Universal Console TCP33T is a Teams Rooms‑certified touch console designed for Microsoft Surface Hub and MAXHUB XBoard. It allows users to join meetings, invite participants, control meetings, and share content without leaving their seats—supporting smooth, focused, and efficient collaboration across meeting spaces. Learn more. MAXHUB XBar V70 Kit The MAXHUB XBar V70 Kit with console is a Teams‑certified videobar built on MDEP Android and designed for medium to large meeting rooms. It features a 200‑megapixel quad‑lens camera system, 16 beamforming microphones, AI‑enhanced audio, and FlexMount for simple installation. Built on Microsoft‑certified Android security architecture, the solution enables secure Teams integration, streamlined deployment, and remote device management through MAXHUB Pivot, with included service coverage to simplify ongoing IT operations. Learn more. Barco ClickShare Hub Pro and Huddly ®C1™ for Teams Rooms on Android The ClickShare Hub Pro and Huddly C1 bundle is a certified Microsoft Teams Rooms solution for small‑to‑medium meeting rooms. ClickShare Hub Pro enables one‑click, wireless conferencing and 4K content sharing with next‑generation ClickShare Buttons and dual‑screen support, all built on the Microsoft Device Ecosystem Platform for secure meetings. Huddly C1 adds modular, AI‑driven video and intelligent audio that scales from standalone to multi‑camera setups—delivering engaging meetings for participants and flexible, enterprise‑grade management for IT teams. Learn More Yealink UH42 / UH44 and WH68 Headsets Yealink expanded its portfolio of Teams‑certified headsets with wired UH42 and UH44 models and the WH68 Hybrid headset with charging stand. These devices are designed for professional use across open offices and hybrid work scenarios, offering clear audio, comfortable form factors for all‑day wear, and flexible connectivity options to support modern Teams calling and meetings. Yealink UH 42 and 44 (Mono) Yealink UH 42 and 44 (Dual) Yealink WH68Sentinel Foundry - MCP Server (Github Community Release)
I’ve been cooking something that a lot of people in SOC have been struggling with — especially on the engineering side of Microsoft Sentinel. Thanks to the Microsoft Security team for shaping the capabilities of Sentinel even better with Sentinel Data Lake & Modern SecOps. Today’s the day I can finally share it. Note: This is not an official Microsoft product, but it is designed to make the Sentinel Build even better (complement) with much more intelligence. 🚀 Sentinel Foundry is now in public preview with 43 tools. (Sentinel Foundry - MCP Server) It’s an MCP server built to act like the brain of a strong Sentinel engineer — helping make building, improving, and operating Sentinel far more practical, faster, and honestly more enjoyable. For a lot of teams, the challenge is not understanding what Sentinel can do. The hard part is the engineering work around it: -> Deciding what data should actually be ingested -> Building a clean, scalable Sentinel foundation -> Writing useful detections instead of noisy ones -> Balancing security value with cost -> Turning ideas into deployable engineering outputs That is exactly why I built Sentinel Foundry to help communities grow stronger. It helps with the real engineering tasks behind Sentinel — from architecture thinking to detection design, deployment planning, ingestion strategy, automation ideas, and many of the workflows outlined in the GitHub project. How does it work? Here’s one of the flagship prompts I ran with it: “Give me a complete security posture report for our workspace. Score each pillar and tell me what to prioritise.” And within seconds, it produced a structured engineering blueprint that would normally take a lot longer to pull together manually. You can see the example prompts here in what it can do: https://github.com/prabhukiranveesam/Sentinel-Foundry#what-can-it-do I want building Sentinel to feel less like repetitive engineering overhead — and more like real security engineering that is fast, creative, and enjoyable. If you work with Sentinel as a SOC L2 analyst, engineer, detection engineer, consultant, or architect, I’d genuinely love for you to try it and tell me what you think. 🔗 Public Preview: https://github.com/prabhukiranveesam/Sentinel-Foundry This is just the start of an AI era — and I’m excited to keep shaping it with more powerful features over the coming days. This is very easy to set up and will be available to all of you at no cost during this month as part of the public preview, and your feedback is extremely valuable to shape this as a powerful solution.What’s new in Microsoft Sentinel: July 2026
Welcome back to What's new in Microsoft Sentinel. In July, Sentinel adds custom detections support in Sentinel repositories, so you can manage detections as code alongside your analytics rules, playbooks, parsers, and workbooks, authoring in GitHub and deploying through the CI/CD pipelines you already use. In Sentinel data lake, table insights brings table-level observability into the Microsoft Defender portal, helping you track ingestion volume, spot week-over-week changes, and catch connectors that have gone silent, all without running a single KQL query. Connector coverage also expands with GitHub Audit logs, Agari, and Airlock Digital, bringing more of the signals that matter to you into one place. Read on for the details, and if you're joining us at Black Hat USA 2026, don't miss the keynote from Agentic Security CVP David Weston and other Microsoft Security activities at this event. Explore our resources at the end to go deeper. Sentinel innovations: Sentinel SIEM Sentinel data lake Sentinel SIEM Custom detections support in Sentinel repositories [Public Preview] Custom detections can be managed as code through Sentinel repositories, alongside analytics rules, playbooks, parsers, and workbooks, completing the detections-as-code workflow across the full Sentinel portfolio. Teams can author detections in GitHub, review through pull requests, and deploy via existing CI/CD pipelines or the Microsoft Security Bicep extension. Learn how to manage custom content with repository connections. Behind the Build with Gigamon: Enriching Sentinel with network-derived telemetry Learn how Gigamon's integration with Sentinel brings network-derived telemetry into your security investigations, correlated with the identity, endpoint, and cloud signals already in your workspace. By adding this runtime context, you can trace suspicious activity across environments and investigate threats that span traditionally siloed domains, with faster and more accurate investigations, higher-quality signal, and clearer visibility into encrypted and hybrid cloud traffic that logs alone often miss. Read the blog to explore the integration and what it means for your security operations. Sentinel data lake Table insights [Public Preview] Table insights is a built-in monitoring view on the tables page in the Microsoft Defender portal that gives you table-level observability for your Sentinel workspace without running KQL queries or opening a separate workbook. Table insights surfaces the signals you rely on most: 📊 Ingestion volume by tier – compare analytics versus data lake 📉 Day-over-week ingestion fluctuations – spot drops or spikes against the same day last week 🔝 Top 5 tables by daily ingestion volume – identify your biggest cost drivers at a glance 🕐 Last data received – catch connectors that stopped sending data 💰 Estimated daily ingestion cost – per-table cost to inform tier and retention decisions ⚠️ Volume anomaly – signed percentage change versus baseline to flag unusual behavior early Figure 1: View all table insights and investigate your table behavior with Sentinel in the Defender portal. Together, these signals help you spot collection failures early, so you can act before they turn into bigger problems. Learn more. Connectors [Public Preview] GitHub Audit logs (via Azure Storage Blob) The GitHub Audit logs connector ingests GitHub Enterprise audit logs into Sentinel from Azure Blob Storage with near real-time latency, so you can view this data in workbooks, create custom alerts, and strengthen your investigations. This requires Audit log streaming to be set up on GitHub for an Enterprise. Learn how to stream audit logs. Agari The Agari Data connector allows ingesting logs from Agari APIs into Sentinel. This connector integrates with Agari Brand Protection (BP) and Phishing Defense (APD). It supports Data Collection Rules-based ingestion time transformations for efficient query execution. Airlock Digital Ingests Airlock Digital application control and execution events to strengthen endpoint threat detection and response. Additional resources Blogs and documentation: Configure table settings in Sentinel Manage data tiers and retention in Sentinel Sentinel CI/CD repositories sample Upcoming events: Featured event: Aug 1–6, Black Hat USA 2026 (Mandalay Bay, Las Vegas) Keynote with Agentic Security CVP David Weston The end of rare: Defending when offense is cheap Wednesday, Aug 5 | 9:15 AM – 10 AM Main stage with Microsoft Security CVP Aarti Borkar and Microsoft Security Research VP Tanmay Ganacharya Poisoned at the source: Inside Microsoft Threat Intelligence's hunt for supply chain attacks Wednesday, Aug 5 | 2:30 PM – 3 PM Main stage with Customer Success GM Wes Malaby Mind the gap: Turning threat intelligence into decisive action with expert-led defense Wednesday, Aug 5 | 11:25 AM – 11:45 AM Mandalay Bay K with Principal Product Manager Naadia Sayed Agentic security: What's next Wednesday, Aug 5 | 11:15 AM – 12 PM Microsoft Security Black Hat USA 2026 VIP mixer hosted by Microsoft Security CVP Aarti Borkar Swingers at Mandalay Bay Resort – Register here Wednesday, Aug 5 | 6 PM – 9 PM Microsoft booth #2144 with live sessions, AMAs, and hands-on demos of our latest security innovations Learn more in our Black Hat 2026 blog Upcoming webinars: Aug 6: Security Immersion Event: Into the Breach Aug 13–14: Microsoft Virtual Training Day: Predict and Defend Against Cybersecurity Threats Aug 19: Microsoft Security Immersion Event: Shadow Hunter Aug 20: Microsoft Security Immersion Event: Agent Hackathon Aug 25: Tech Brief: Modernize security operations with a unified platform Stay connected Check back each month for the latest innovations, updates, and events to ensure you’re getting the most out of Microsoft Sentinel. We’ll see you in the next edition!
